package org.darcy.admin.config;

import org.darcy.admin.filter.JwtAuthenticationTokenFilter;
import org.darcy.admin.manager.AuthenticationEntryPointImpl;
import org.darcy.admin.manager.CustomAccessDeniedHandler;
import org.darcy.admin.manager.CustomAuthenticationProvider;
import org.darcy.service.service.impl.UserDetailServiceImpl;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.authentication.logout.LogoutFilter;
import org.springframework.web.filter.CorsFilter;

/**
 * Security配置
 */
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

	/**
	 * 跨域过滤器
	 */
	@Autowired
	private CorsFilter corsFilter;

	/**
	 * token认证过滤器
	 */
	@Bean
	public JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter() {
		return new JwtAuthenticationTokenFilter();
	}

	/**
	 * 认证失败处理类
	 */
	@Bean
	public AuthenticationEntryPointImpl unauthorizedHandler() {
		return new AuthenticationEntryPointImpl();
	}

	/**
	 * 鉴权失败处理类
	 */
	@Bean
	public CustomAccessDeniedHandler accessDeniedHandler() {
		return new CustomAccessDeniedHandler();
	}

	@Override
	protected void configure(AuthenticationManagerBuilder auth) {
		auth.authenticationProvider(new CustomAuthenticationProvider(new UserDetailServiceImpl()));
	}

	/**
	 * anyRequest | 匹配所有请求路径 access | SpringEl表达式结果为true时可以访问 anonymous | 匿名可以访问
	 * denyAll | 用户不能访问 fullyAuthenticated | 用户完全认证可以访问（非remember-me下自动登录）
	 * hasAnyAuthority | 如果有参数，参数表示权限，则其中任何一个权限可以访问 hasAnyRole |
	 * 如果有参数，参数表示角色，则其中任何一个角色可以访问 hasAuthority | 如果有参数，参数表示权限，则其权限可以访问 hasIpAddress
	 * | 如果有参数，参数表示IP地址，如果用户IP和参数匹配，则可以访问 hasRole | 如果有参数，参数表示角色，则其角色可以访问 permitAll
	 * | 用户可以任意访问 rememberMe | 允许通过remember-me登录的用户访问 authenticated | 用户登录后可访问
	 */
	@Override
	protected void configure(HttpSecurity http) throws Exception {

		// CRSF禁用，因为不使用session
		http.cors().and().csrf().disable()
				// 认证失败处理类
				.exceptionHandling().authenticationEntryPoint(unauthorizedHandler())
				.accessDeniedHandler(accessDeniedHandler()).and()
				// 基于token，所以不需要session
				.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
				// 过滤请求
				.authorizeRequests()
				// 跨域预检请求
//            .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
				// 对于登录login 验证码captchaImage 和其他放行的目录 允许匿名访问"/citylife/front/**"
				.antMatchers("/api/admin/login", "/api/admin/validate/code/get").permitAll()
				.antMatchers("/api/admin/getLoginPic").permitAll()
				// 静态资源路径
				.antMatchers("/", "/assets/**", "/public/**").anonymous()
				// 放行图片、文件上传
				.antMatchers("/api/admin/upload/image").permitAll().antMatchers("/api/admin/upload/file").permitAll()
				// 代码生成器
				.antMatchers("/api/codegen/code").permitAll()
//            .antMatchers("/wx/user/*/login","/citylife/nocheck/**").anonymous()
				.antMatchers(HttpMethod.GET, "/*.html", "/**/*.html", "/**/*.css", "/**/*.js").permitAll()
				.antMatchers("/profile/**").anonymous().antMatchers("/common/download**").anonymous()
				.antMatchers("/common/download/resource**").anonymous().antMatchers("/doc.html").permitAll()
				.antMatchers("/swagger-resources/**").permitAll().antMatchers("/webjars/**").permitAll()
				.antMatchers("/v2/**").permitAll().antMatchers("/swagger-ui.html/**").permitAll()
				.antMatchers("/*/api-docs").anonymous().antMatchers("/druid/**").anonymous()
				.antMatchers("/captcha/get", "/captcha/check").anonymous().antMatchers("/api/admin/payment/callback/**")
				.anonymous().antMatchers("/api/public/**").anonymous()
				// 除上面外的所有请求全部需要鉴权认证
				.anyRequest().authenticated().and().headers().frameOptions().disable();// 防止iframe 造成跨域
//        http.logout().logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler);
		// 添加JWT filter
		// 开启登录认证流程过滤器
		http.addFilterBefore(jwtAuthenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class);
		// 添加CORS filter
		http.addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class);
		http.addFilterBefore(corsFilter, LogoutFilter.class);
	}

}
